I'm using a pipeline with github-actions to build an image and to push it into an azure container registry, then using this image, have the deployment applied to AKS (Azure/k8s-deploy@v4 - https://github.com/Azure/k8s-deploy). Pipeline as described here: https://docs.microsoft.com/en-us/azure/aks/kubernetes-action On one of the clusters I'm facing with an issue in the deployment step.
My self-hosted agents are running on AKS as well.
One one cluster pipeline works totally fine:
Deploying manifests
/usr/bin/az aks command invoke --resource-group *** --name *** --command kubectl apply -f deployment-test.yaml --file .
command started at 2022-08-29 14:43:09+00:00, finished at 2022-08-29 14:43:11+00:00 with exitcode=0
deployment.apps/deployment-test created
service/service-test created
ingress.networking.k8s.io/ingress-test created
however on another cluster with the same configuration, same version (1.23) it bumps into an authentication issue, where non-interactive authentication isn't possible:
Deploying manifests
/opt/hostedtoolcache/kubectl/1.25.1/x64/kubectl apply -f /tmp/deployment.yaml --force --insecure-skip-tls-verify --namespace *******
W0916 11:09:01.696594 2327 azure.go:92] WARNING: the azure auth plugin is deprecated in v1.22+, unavailable in v1.26+; use https://github.com/Azure/kubelogin instead.
To learn more, consult https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code RG****Q to authenticate.
E0916 11:24:03.590914 2327 azure.go:162] Failed to acquire a token: failed acquiring new token: waiting for device code authentication to complete: autorest/adal/devicetoken: Error while retrieving OAuth token: Code Expired
Notes: the problem occurs with the cluster on which github-runners are deployed -- i.e. I'm trying to deploy to a cluster using github-runners, which are running on the very same cluster. In case where it works fine, I'm deploying to another cluster (not where the github-runners are deployed). Another difference is, the cluster where pipeline succeeds is a 'private' cluster, while another one is not.
I've followed exactly the same configuration in both cases for service principals and related permissions. Firewall setting are same for both VNETs used by these AKS clusters.
I understand what the error says, but not sure how to go about it, I can use some community help here. Thanks in advance!